CVE-2021-4010: 
Rocky Linux vulnerability analysis and mitigation

A vulnerability (CVE-2021-4010) was discovered in xorg-x11-server versions before 21.1.2 and before 1.20.14. The flaw involves an out-of-bounds access that can occur in the SProcScreenSaverSuspend function. This vulnerability was discovered by Jan-Niklas Sohn working with Trend Micro Zero Day Initiative and was disclosed in December 2021 (Vendor Advisory, ZDI Advisory).

The vulnerability is caused by improper validation of user-supplied data in the handling of SProcScreenSaverSuspend requests, which can result in a memory access past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The flaw is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) (NVD, ZDI Advisory).

The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. It can lead to local privilege escalation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root (ZDI Advisory, Vendor Advisory).

The vulnerability has been fixed in xorg-server versions 21.1.2 and 1.20.14. Various distributions have released security updates to address this vulnerability, including Debian (DSA-5027-1), Fedora, and Gentoo. Users are advised to upgrade to the patched versions (Debian Advisory, Gentoo Advisory).